| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: File recovery in der Taskleiste + System error messageWindows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
 |
12.08.2012, 21:17
| #1 |
 |  File recovery in der Taskleiste + System error message Surfen im I- net und dann o.g. Fehlermeldung. Desktop wurde leer, File recovery tat sich auf und "animiert" zum kauf einer Vollversion, Firefox meldet sich ab und dann 20-30 System errors message.... Und ich hatte eben die kompletten Logs hier schon drin und dann sagte mir das Board beim versenden nicht angemeldet..... Ich habe mir malware aktualisiert und quick und normal durchgeführt: Malwarebytes Anti-Malware (Test) 1.62.0.1300 www.malwarebytes.org Datenbank Version: v2012.08.12.03 Windows Vista Service Pack 1 x86 NTFS Internet Explorer 7.0.6001.18000 Papa :: FRANZI-PC [Administrator] Schutz: Aktiviert 12.08.2012 13:17:03 mbam-log-2012-08-12 (21-54-19).txt Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|) Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM Deaktivierte Suchlaufeinstellungen: P2P Durchsuchte Objekte: 358336 Laufzeit: 53 Minute(n), 42 Sekunde(n) Infizierte Speicherprozesse: 2 C:\ProgramData\WQaJpUNUgPHe.exe (Rogue.FakeHDD) -> 4084 -> Keine Aktion durchgeführt. C:\ProgramData\SoIaMjphesp9YP.exe (Rogue.FakeHDD) -> 4092 -> Keine Aktion durchgeführt. Infizierte Speichermodule: 1 C:\ProgramData\DownloadnSave\bhoclass.dll (PUP.DownloadnSave) -> Keine Aktion durchgeführt. Infizierte Registrierungsschlüssel: 5 HKCR\CLSID\{96DE4F15-8EF3-5425-4360-D37D8DA9371D} (PUP.DownloadnSave) -> Keine Aktion durchgeführt. HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{96DE4F15-8EF3-5425-4360-D37D8DA9371D} (PUP.DownloadnSave) -> Keine Aktion durchgeführt. HKCR\TypeLib\{C2CF0D01-7657-48AA-98C9-AE5E64757FCC} (PUP.DownloadnSave) -> Keine Aktion durchgeführt. HKCR\Interface\{BBA74401-6D6F-4BBD-9F65-E8623814F3BB} (PUP.DownloadnSave) -> Keine Aktion durchgeführt. HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{A8B0DBDE-8119-48B0-8088-D12DA01C36BA} (PUP.DownloadnSave) -> Keine Aktion durchgeführt. Infizierte Registrierungswerte: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateiobjekte der Registrierung: 0 (Keine bösartigen Objekte gefunden) Infizierte Verzeichnisse: 2 C:\ProgramData\DownloadnSave (PUP.DownloadnSave) -> Keine Aktion durchgeführt. C:\ProgramData\DownloadnSave\data (PUP.DownloadnSave) -> Keine Aktion durchgeführt. Infizierte Dateien: 16 C:\ProgramData\WQaJpUNUgPHe.exe (Rogue.FakeHDD) -> Keine Aktion durchgeführt. C:\ProgramData\SoIaMjphesp9YP.exe (Rogue.FakeHDD) -> Keine Aktion durchgeführt. C:\ProgramData\DownloadnSave\bhoclass.dll (PUP.DownloadnSave) -> Keine Aktion durchgeführt. C:\Users\Netzbenutzer\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\J4GCR3XH\krevkqcmdubtfvdz8[1].exe (Rogue.FakeHDD) -> Keine Aktion durchgeführt. C:\Users\Netzbenutzer\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\J4GCR3XH\Gxv1zF45[1].exe (Exploit.Drop.COD) -> Keine Aktion durchgeführt. C:\Users\Netzbenutzer\AppData\Local\Temp\wYHCrAaxE5MMYA.exe.tmp (Rogue.FakeHDD) -> Keine Aktion durchgeführt. C:\Users\Netzbenutzer\AppData\Local\Temp\tmpA8E6.tmp.exe (RootKit.0Access) -> Keine Aktion durchgeführt. C:\Users\Netzbenutzer\Desktop\Downloads\MB-Scrsaver.zip.exe (Affiliate.Downloader) -> Keine Aktion durchgeführt. C:\Users\Papa\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\W6JK739V\4fdbb519d63b4[1].exe (Adware.Dropper) -> Keine Aktion durchgeführt. C:\Users\Papa\AppData\Local\Temp\{FFFE3346-117B-503B-B2D0-5959241D11B0}\Addons\download_save.exe (Adware.Dropper) -> Keine Aktion durchgeführt. C:\Users\Netzbenutzer\AppData\Local\Temp\wuauclt.exe (Trojan.Agent) -> Keine Aktion durchgeführt. C:\ProgramData\DownloadnSave\content.js (PUP.DownloadnSave) -> Keine Aktion durchgeführt. C:\ProgramData\DownloadnSave\background.html (PUP.DownloadnSave) -> Keine Aktion durchgeführt. C:\ProgramData\DownloadnSave\odeoclokhmjimjdcfohekbelankbmihb.crx (PUP.DownloadnSave) -> Keine Aktion durchgeführt. C:\ProgramData\DownloadnSave\settings.ini (PUP.DownloadnSave) -> Keine Aktion durchgeführt. C:\ProgramData\DownloadnSave\uninstall.exe (PUP.DownloadnSave) -> Keine Aktion durchgeführt. (Ende) Das Lesen im Board hat mich auf unhide.exe gebracht: Unhide by Lawrence Abrams (Grinler) hxxp://www.bleepingcomputer.com/ Copyright 2008-2012 BleepingComputer.com More Information about Unhide.exe can be found at this link: hxxp://www.bleepingcomputer.com/forums/topic405109.html Program started at: 08/12/2012 01:57:33 PM Windows Version: Windows Vista Please be patient while your files are made visible again. Processing the C:\ drive Finished processing the C:\ drive. 122741 files processed. Processing the D:\ drive Finished processing the D:\ drive. 36392 files processed. Processing the F:\ drive Finished processing the F:\ drive. 0 files processed. The C:\Users\Papa\AppData\Local\Temp\smtmp\ folder does not exist!! Unhide cannot restore your missing shortcuts!! Please see this topic in order to learn how to restore default Start Menu shortcuts: hxxp://www.bleepingcomputer.com/forums/topic405109.html Searching for Windows Registry changes made by FakeHDD rogues. No registry changes detected. Restarting Explorer.exe in order to apply changes. Program finished at: 08/12/2012 02:00:02 PM Execution time: 0 hours(s), 2 minute(s), and 29 seconds(s) Abschliessend ist wohl OTL angesagt. OTL logfile created on: 12.08.2012 21:37:09 - Run 1 OTL by OldTimer - Version 3.2.57.0 Folder = C:\Users\Papa\Desktop Windows Vista Home Premium Edition Service Pack 1 (Version = 6.0.6001) - Type = NTWorkstation Internet Explorer (Version = 7.0.6001.18000) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 2,00 Gb Total Physical Memory | 0,98 Gb Available Physical Memory | 49,21% Memory free 4,23 Gb Paging File | 2,60 Gb Available in Paging File | 61,55% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files Drive C: | 142,16 Gb Total Space | 6,74 Gb Free Space | 4,74% Space Free | Partition Type: NTFS Drive D: | 142,93 Gb Total Space | 41,89 Gb Free Space | 29,31% Space Free | Partition Type: NTFS Computer Name: FRANZI-PC | User Name: Papa | Logged in as Administrator. Boot Mode: Normal | Scan Mode: All users Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days ========== Processes (SafeList) ========== PRC - C:\Users\Papa\Desktop\OTL.exe (OldTimer Tools) PRC - C:\ProgramData\SoIaMjphesp9YP.exe (XNN) PRC - C:\ProgramData\WQaJpUNUgPHe.exe (XNN) PRC - d:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation) PRC - d:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation) PRC - d:\Program Files\Malwarebytes' Anti-Malware\mbam.exe (Malwarebytes Corporation) PRC - C:\Programme\SweetIM\Messenger\SweetIM.exe (SweetIM Technologies Ltd.) PRC - C:\Programme\SweetIM\Communicator\SweetPacksUpdateManager.exe (SweetIM Technologies Ltd.) PRC - C:\Programme\SiteAdvisor\6172\SAService.exe () PRC - C:\Windows\RtHDVCpl.exe (Realtek Semiconductor) PRC - C:\Programme\Acer\Empowering Technology\eDataSecurity\x86\eDSService.exe (Egis Incorporated) PRC - C:\Programme\Acer\Empowering Technology\eDataSecurity\x86\eDSLoader.exe (Egis Incorporated) PRC - C:\Programme\Acer\Empowering Technology\SysMonitor.exe () PRC - C:\Programme\Acer\Empowering Technology\Service\ETService.exe () PRC - C:\Programme\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\CLMSServer.exe (CyberLink) PRC - c:\Programme\Common Files\McAfee\MNA\McNASvc.exe (McAfee, Inc.) PRC - C:\Windows\explorer.exe (Microsoft Corporation) PRC - C:\Windows\System32\conime.exe (Microsoft Corporation) PRC - C:\Programme\Internet Explorer\iexplore.exe (Microsoft Corporation) PRC - C:\Programme\SiteAdvisor\6172\SiteAdv.exe () PRC - C:\Programme\McAfee\MSK\msksrver.exe (McAfee, Inc.) PRC - c:\Programme\Common Files\McAfee\McProxy\McProxy.exe (McAfee, Inc.) PRC - C:\Programme\McAfee\MSC\mcmscsvc.exe (McAfee, Inc.) PRC - c:\Programme\McAfee.com\Agent\mcagent.exe (McAfee, Inc.) PRC - C:\Programme\McAfee\VirusScan\mcsysmon.exe (McAfee, Inc.) PRC - C:\Programme\McAfee\VirusScan\Mcshield.exe (McAfee, Inc.) PRC - C:\Programme\McAfee\MPF\MpfSrv.exe (McAfee, Inc.) PRC - c:\Programme\McAfee\MSC\mcuimgr.exe (McAfee, Inc.) PRC - C:\Programme\Adobe\Reader 8.0\Reader\AcroRd32.exe (Adobe Systems Incorporated) PRC - C:\Programme\avmwlanstick\WLanGUI.exe (AVM) PRC - C:\Programme\avmwlanstick\WLanNetService.exe (AVM Berlin) ========== Modules (No Company Name) ========== MOD - C:\ProgramData\DownloadnSave\bhoclass.dll () MOD - C:\Programme\SiteAdvisor\6172\saHook.dll () MOD - C:\Programme\Acer\Empowering Technology\eDataSecurity\x86\ShowErrMsg.dll () MOD - C:\Programme\Acer\Empowering Technology\SysMonitor.exe () MOD - C:\Programme\NewTech Infosystems\NTI Backup Now 5\BkupTrayLOC.dll () MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\45ee94a63c463b93e3ff694c6ecd0820\System.Windows.Forms.ni.dll () MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\a35f567c4c67d6b1ca9a0023852847a2\System.Drawing.ni.dll () MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System\267d4c344058092e6950c11594244f90\System.ni.dll () MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\5b3e3b0551bcaa722c27dbb089c431e4\mscorlib.ni.dll () MOD - c:\Programme\McAfee\MSK\mcapbho.dll () MOD - C:\Programme\SiteAdvisor\6172\SiteAdv.exe () MOD - C:\Programme\SiteAdvisor\6172\SiteAdv.dll () MOD - c:\Programme\Adobe\Reader 8.0\Reader\RdLang32.DEU () MOD - C:\Programme\Adobe\Reader 8.0\Reader\plug_ins\Weblink.DEU () MOD - C:\Programme\Adobe\Reader 8.0\Reader\plug_ins\Spelling.DEU () MOD - C:\Programme\Adobe\Reader 8.0\Reader\plug_ins\SendMail.deu () MOD - C:\Programme\Adobe\Reader 8.0\Reader\plug_ins\Search.DEU () MOD - C:\Programme\Adobe\Reader 8.0\Reader\plug_ins\PPKLITE.DEU () MOD - C:\Programme\Adobe\Reader 8.0\Reader\plug_ins\SaveAsRTF.DEU () MOD - C:\Programme\Adobe\Reader 8.0\Reader\plug_ins\ReadOutLoud.DEU () MOD - C:\Programme\Adobe\Reader 8.0\Reader\plug_ins\Multimedia.DEU () MOD - C:\Programme\Adobe\Reader 8.0\Reader\plug_ins\makeaccessible.DEU () MOD - C:\Programme\Adobe\Reader 8.0\Reader\plug_ins\Escript.deu () MOD - C:\Programme\Adobe\Reader 8.0\Reader\plug_ins\EWH32.DEU () MOD - C:\Programme\Adobe\Reader 8.0\Reader\plug_ins\DigSig.DEU () MOD - C:\Programme\Adobe\Reader 8.0\Reader\plug_ins\Annots.DEU () MOD - C:\Programme\Adobe\Reader 8.0\Reader\plug_ins\Checkers.DEU () MOD - C:\Programme\Adobe\Reader 8.0\Reader\plug_ins\Acroform.DEU () MOD - C:\Programme\Adobe\Reader 8.0\Reader\plug_ins\accessibility.DEU () MOD - C:\Programme\Adobe\Reader 8.0\Reader\ccme_base.dll () MOD - C:\Programme\Adobe\Reader 8.0\Reader\cryptocme2.dll () MOD - C:\Programme\Adobe\Reader 8.0\Reader\plug_ins\updater.DEU () MOD - C:\Programme\Adobe\Reader 8.0\Reader\plug_ins\Search5.DEU () MOD - C:\Programme\Adobe\Reader 8.0\Reader\plug_ins\reflow.DEU () MOD - C:\Programme\Adobe\Reader 8.0\Reader\plug_ins\pddom.DEU () MOD - C:\Programme\Adobe\Reader 8.0\Reader\plug_ins\Hls.deu () MOD - C:\Programme\Adobe\Reader 8.0\Reader\plug_ins\eBook.DEU () ========== Win32 Services (SafeList) ========== SRV - (MBAMService) -- d:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation) SRV - (MozillaMaintenance) -- C:\Programme\Mozilla Maintenance Service\maintenanceservice.exe (Mozilla Foundation) SRV - (SiteAdvisor Service) -- C:\Programme\SiteAdvisor\6172\SAService.exe () SRV - (eDataSecurity Service) -- C:\Programme\Acer\Empowering Technology\eDataSecurity\x86\eDSService.exe (Egis Incorporated) SRV - (ETService) -- C:\Programme\Acer\Empowering Technology\Service\ETService.exe () SRV - (Acer HomeMedia Connect Service) -- C:\Programme\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\CLMSServer.exe (CyberLink) SRV - (McNASvc) -- c:\Programme\Common Files\McAfee\MNA\McNASvc.exe (McAfee, Inc.) SRV - (WMPNetworkSvc) -- C:\Programme\Windows Media Player\wmpnetwk.exe (Microsoft Corporation) SRV - (WinDefend) -- C:\Programme\Windows Defender\MpSvc.dll (Microsoft Corporation) SRV - (MSK80Service) -- C:\Programme\McAfee\MSK\msksrver.exe (McAfee, Inc.) SRV - (odserv) -- C:\Programme\Common Files\microsoft shared\OFFICE12\ODSERV.EXE (Microsoft Corporation) SRV - (McProxy) -- c:\Programme\Common Files\McAfee\McProxy\McProxy.exe (McAfee, Inc.) SRV - (mcmscsvc) -- C:\Programme\McAfee\MSC\mcmscsvc.exe (McAfee, Inc.) SRV - (McODS) -- C:\Programme\McAfee\VirusScan\mcods.exe (McAfee, Inc.) SRV - (McSysmon) -- C:\Programme\McAfee\VirusScan\mcsysmon.exe (McAfee, Inc.) SRV - (McShield) -- C:\Programme\McAfee\VirusScan\Mcshield.exe (McAfee, Inc.) SRV - (MpfService) -- C:\Programme\McAfee\MPF\MpfSrv.exe (McAfee, Inc.) SRV - (ose) -- C:\Programme\Common Files\microsoft shared\Source Engine\OSE.EXE (Microsoft Corporation) SRV - (AVM WLAN Connection Service) -- C:\Programme\avmwlanstick\WLanNetService.exe (AVM Berlin) ========== Driver Services (SafeList) ========== DRV - (NwlnkFwd) -- system32\DRIVERS\nwlnkfwd.sys File not found DRV - (NwlnkFlt) -- system32\DRIVERS\nwlnkflt.sys File not found DRV - (IpInIp) -- system32\DRIVERS\ipinip.sys File not found DRV - (MBAMSwissArmy) -- C:\Windows\System32\drivers\mbamswissarmy.sys (Malwarebytes Corporation) DRV - (MBAMProtector) -- C:\Windows\System32\drivers\mbam.sys (Malwarebytes Corporation) DRV - (USB28xxBGA) -- C:\Windows\System32\drivers\emBDA.sys (eMPIA Technology, Inc.) DRV - (USB28xxOEM) -- C:\Windows\System32\drivers\emOEM.sys (eMPIA Technology, Inc.) DRV - (nvlddmkm) -- C:\Windows\System32\drivers\nvlddmkm.sys (NVIDIA Corporation) DRV - (nvstor32) -- C:\Windows\System32\drivers\nvstor32.sys (NVIDIA Corporation) DRV - (int15) -- C:\Windows\System32\drivers\int15.sys (Acer, Inc.) DRV - (tvicport) -- C:\Windows\System32\drivers\TVicPort.sys (EnTech Taiwan) DRV - (zntport) -- C:\Windows\System32\drivers\zntport.sys (Zeal SoftStudio) DRV - (NVENETFD) -- C:\Windows\System32\drivers\nvmfdx32.sys (NVIDIA Corporation) DRV - (mferkdk) -- C:\Windows\System32\drivers\mferkdk.sys (McAfee, Inc.) DRV - (mfeavfk) -- C:\Windows\System32\drivers\mfeavfk.sys (McAfee, Inc.) DRV - (mfehidk) -- C:\Windows\System32\drivers\mfehidk.sys (McAfee, Inc.) DRV - (mfesmfk) -- C:\Windows\System32\drivers\mfesmfk.sys (McAfee, Inc.) DRV - (mfebopk) -- C:\Windows\System32\drivers\mfebopk.sys (McAfee, Inc.) DRV - (MPFP) -- C:\Windows\System32\drivers\Mpfp.sys (McAfee, Inc.) DRV - (FWLANUSB) -- C:\Windows\System32\drivers\fwlanusb.sys (AVM GmbH) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&s=1&o=vp32&d=0612&m=aspire_x1700 IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&s=1&o=vp32&d=0612&m=aspire_x1700 IE - HKLM\..\SearchScopes,DefaultScope = {67A2568C-7A0A-4EED-AECC-B5405DE63B64} IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?} IE - HKLM\..\SearchScopes\{67A2568C-7A0A-4EED-AECC-B5405DE63B64}: "URL" = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7ACAW IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-21-1740670893-1896631952-3822091605-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&s=1&o=vp32&d=0612&m=aspire_x1700 IE - HKU\S-1-5-21-1740670893-1896631952-3822091605-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = hxxp://global.acer.com [binary data] IE - HKU\S-1-5-21-1740670893-1896631952-3822091605-1000\SOFTWARE\Microsoft\Internet Explorer\Main,SearchDefaultBranded = 1 IE - HKU\S-1-5-21-1740670893-1896631952-3822091605-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Secondary Start Pages = hxxp://global.acer.com [binary data] IE - HKU\S-1-5-21-1740670893-1896631952-3822091605-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&s=1&o=vp32&d=0612&m=aspire_x1700 IE - HKU\S-1-5-21-1740670893-1896631952-3822091605-1000\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1 IE - HKU\S-1-5-21-1740670893-1896631952-3822091605-1000\..\SearchScopes,DefaultScope = {67A2568C-7A0A-4EED-AECC-B5405DE63B64} IE - HKU\S-1-5-21-1740670893-1896631952-3822091605-1000\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?} IE - HKU\S-1-5-21-1740670893-1896631952-3822091605-1000\..\SearchScopes\{67A2568C-7A0A-4EED-AECC-B5405DE63B64}: "URL" = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7ACAW IE - HKU\S-1-5-21-1740670893-1896631952-3822091605-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-21-1740670893-1896631952-3822091605-1002\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&s=1&o=vp32&d=0612&m=aspire_x1700 IE - HKU\S-1-5-21-1740670893-1896631952-3822091605-1002\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = hxxp://global.acer.com [binary data] IE - HKU\S-1-5-21-1740670893-1896631952-3822091605-1002\SOFTWARE\Microsoft\Internet Explorer\Main,SearchDefaultBranded = 1 IE - HKU\S-1-5-21-1740670893-1896631952-3822091605-1002\SOFTWARE\Microsoft\Internet Explorer\Main,Secondary Start Pages = hxxp://global.acer.com [binary data] IE - HKU\S-1-5-21-1740670893-1896631952-3822091605-1002\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&s=1&o=vp32&d=0612&m=aspire_x1700 IE - HKU\S-1-5-21-1740670893-1896631952-3822091605-1002\..\URLSearchHook: {EEE6C35D-6118-11DC-9C72-001320C79847} - C:\Programme\SweetIM\Toolbars\Internet Explorer\mgHelper.dll (SweetIM Technologies Ltd.) IE - HKU\S-1-5-21-1740670893-1896631952-3822091605-1002\..\SearchScopes,DefaultScope = {67A2568C-7A0A-4EED-AECC-B5405DE63B64} IE - HKU\S-1-5-21-1740670893-1896631952-3822091605-1002\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?} IE - HKU\S-1-5-21-1740670893-1896631952-3822091605-1002\..\SearchScopes\{67A2568C-7A0A-4EED-AECC-B5405DE63B64}: "URL" = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7ACAW IE - HKU\S-1-5-21-1740670893-1896631952-3822091605-1002\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 ========== FireFox ========== FF - user.js - File not found FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32_11_2_202_235.dll () FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 13.0\extensions\\Components: d:\Program Files\Mozilla Firefox\components [2012.07.18 15:48:57 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 13.0\extensions\\Plugins: d:\Program Files\Mozilla Firefox\plugins [2012.08.12 14:03:25 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Papa\AppData\Roaming\mozilla\Extensions O1 HOSTS File: ([2006.09.18 23:41:30 | 000,000,761 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts O1 - Hosts: 127.0.0.1 localhost O1 - Hosts: ::1 localhost O2 - BHO: (Adobe PDF Reader) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated) O2 - BHO: (Reg Error: Value error.) - {089FD14D-132B-48FC-8861-0048AE113215} - C:\Programme\SiteAdvisor\6172\SiteAdv.dll () O2 - BHO: (McAfee Phishing Filter) - {377C180E-6F0E-4D4C-980F-F45BD3D40CF4} - c:\Programme\McAfee\MSK\mcapbho.dll () O2 - BHO: (scriptproxy) - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Programme\McAfee\VirusScan\scriptsn.dll (McAfee, Inc.) O2 - BHO: (ShowBarObj Class) - {83A2F9B1-01A2-4AA5-87D1-45B6B8505E96} - C:\Programme\Acer\Empowering Technology\eDataSecurity\x86\ActiveToolBand.dll (Egis) O2 - BHO: (DownloadnSave Class) - {96DE4F15-8EF3-5425-4360-D37D8DA9371D} - C:\ProgramData\DownloadnSave\bhoclass.dll () O2 - BHO: (SweetPacks Browser Helper) - {EEE6C35C-6118-11DC-9C72-001320C79847} - C:\Programme\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll (SweetIM Technologies Ltd.) O3 - HKLM\..\Toolbar: (McAfee SiteAdvisor) - {0BF43445-2F28-4351-9252-17FE6E806AA0} - C:\Programme\SiteAdvisor\6172\SiteAdv.dll () O3 - HKLM\..\Toolbar: (Acer eDataSecurity Management) - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\Programme\Acer\Empowering Technology\eDataSecurity\x86\eDStoolbar.dll (Egis Incorporated.) O3 - HKLM\..\Toolbar: (SweetPacks Toolbar for Internet Explorer) - {EEE6C35B-6118-11DC-9C72-001320C79847} - C:\Programme\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll (SweetIM Technologies Ltd.) O3 - HKU\S-1-5-21-1740670893-1896631952-3822091605-1000\..\Toolbar\ShellBrowser: (Acer eDataSecurity Management) - {5CBE3B7C-1E47-477E-A7DD-396DB0476E29} - C:\Programme\Acer\Empowering Technology\eDataSecurity\x86\eDStoolbar.dll (Egis Incorporated.) O3 - HKU\S-1-5-21-1740670893-1896631952-3822091605-1000\..\Toolbar\WebBrowser: (SweetPacks Toolbar for Internet Explorer) - {EEE6C35B-6118-11DC-9C72-001320C79847} - C:\Programme\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll (SweetIM Technologies Ltd.) O3 - HKU\S-1-5-21-1740670893-1896631952-3822091605-1002\..\Toolbar\WebBrowser: (SweetPacks Toolbar for Internet Explorer) - {EEE6C35B-6118-11DC-9C72-001320C79847} - C:\Programme\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll (SweetIM Technologies Ltd.) O4 - HKLM..\Run: [Acer Empowering Technology Monitor] C:\Programme\Acer\Empowering Technology\SysMonitor.exe () O4 - HKLM..\Run: [AVMWlanClient] C:\Programme\avmwlanstick\WLanGUI.exe (AVM) O4 - HKLM..\Run: [eDataSecurity Loader] C:\Programme\Acer\Empowering Technology\eDataSecurity\x86\eDSLoader.exe (Egis Incorporated) O4 - HKLM..\Run: [EmpoweringTechnology] C:\Program Files\Acer\Empowering Technology\Framework.Launcher.exe boot File not found O4 - HKLM..\Run: [eRecoveryService] File not found O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] d:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation) O4 - HKLM..\Run: [mcagent_exe] C:\Program Files\McAfee.com\Agent\mcagent.exe (McAfee, Inc.) O4 - HKLM..\Run: [NvCplDaemon] C:\Windows\System32\NvCpl.dll (NVIDIA Corporation) O4 - HKLM..\Run: [PCMMediaSharing] C:\Programme\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\PCMMediaSharing.exe () O4 - HKLM..\Run: [RtHDVCpl] C:\Windows\RtHDVCpl.exe (Realtek Semiconductor) O4 - HKLM..\Run: [SiteAdvisor] C:\Programme\SiteAdvisor\6172\SiteAdv.exe () O4 - HKLM..\Run: [SweetIM] C:\Programme\SweetIM\Messenger\SweetIM.exe (SweetIM Technologies Ltd.) O4 - HKLM..\Run: [Sweetpacks Communicator] C:\Programme\SweetIM\Communicator\SweetPacksUpdateManager.exe (SweetIM Technologies Ltd.) O4 - HKLM..\Run: [WarReg_PopUp] C:\Programme\Acer\WR_PopUp\WarReg_PopUp.exe (Acer Incorporated) O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation) O4 - HKU\S-1-5-19..\Run: [WindowsWelcomeCenter] C:\Windows\System32\oobefldr.dll (Microsoft Corporation) O4 - HKU\S-1-5-20..\Run: [WindowsWelcomeCenter] C:\Windows\System32\oobefldr.dll (Microsoft Corporation) O4 - HKU\S-1-5-21-1740670893-1896631952-3822091605-1000..\Run: [LicenseValidator] C:\Users\Netzbenutzer\AppData\Roaming\Identities\{ECEB30EE-3DC7-4CB2-88FC-B205C8974BFC}\LicenseValidator.exe File not found O4 - HKU\S-1-5-21-1740670893-1896631952-3822091605-1000..\Run: [SoIaMjphesp9YP] C:\ProgramData\SoIaMjphesp9YP.exe (XNN) O4 - HKU\S-1-5-21-1740670893-1896631952-3822091605-1000..\Run: [WQaJpUNUgPHe.exe] C:\ProgramData\WQaJpUNUgPHe.exe (XNN) O4 - HKU\S-1-5-21-1740670893-1896631952-3822091605-1002..\Run: [WindowsWelcomeCenter] C:\Windows\System32\oobefldr.dll (Microsoft Corporation) O4 - HKLM..\RunOnce: [ Malwarebytes Anti-Malware ] d:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation) O7 - HKU\S-1-5-21-1740670893-1896631952-3822091605-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O7 - HKU\S-1-5-21-1740670893-1896631952-3822091605-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: LogonHoursAction = 2 O7 - HKU\S-1-5-21-1740670893-1896631952-3822091605-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DontDisplayLogonHoursWarnings = 1 O7 - HKU\S-1-5-21-1740670893-1896631952-3822091605-1002\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O9 - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation) O9 - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation) O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Programme\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation) O13 - gopher Prefix: missing O15 - HKU\S-1-5-21-1740670893-1896631952-3822091605-1000\..Trusted Domains: samsungsetup.com ([www] http in Vertrauenswürdige Sites) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{23354727-1E73-45CF-85FC-7B9D5C176287}: DhcpNameServer = 192.168.2.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{30FB574D-DD06-485F-AED0-9D174A4816C5}: DhcpNameServer = 192.168.2.1 O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11D1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Programme\Common Files\microsoft shared\Help\hxds.dll (Microsoft Corporation) O18 - Protocol\Handler\ms-itss {0A9007C0-4076-11D3-8789-0000F8105754} - c:\Programme\Common Files\microsoft shared\Information Retrieval\msitss.dll (Microsoft Corporation) O18 - Protocol\Handler\siteadvisor {3A5DC592-7723-4EAA-9EE6-AF4222BCF879} - C:\Programme\SiteAdvisor\6172\SiteAdv.dll () O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\microsoft shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation) O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation) O24 - Desktop WallPaper: C:\Windows\Web\Wallpaper\img24.jpg O24 - Desktop BackupWallPaper: C:\Windows\Web\Wallpaper\img24.jpg O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2006.09.18 23:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ] O34 - HKLM BootExecute: (autocheck autochk *) O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3) O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2) ========== Files/Folders - Created Within 30 Days ========== [2012.08.12 21:33:35 | 000,596,992 | ---- | C] (OldTimer Tools) -- C:\Users\Papa\Desktop\OTL.exe [2012.08.12 21:21:04 | 000,000,000 | ---D | C] -- C:\Users\Papa\AppData\Local\Adobe [2012.08.12 21:19:20 | 000,000,000 | ---D | C] -- C:\Users\Papa\AppData\Roaming\Macromedia [2012.08.12 21:19:13 | 000,000,000 | ---D | C] -- C:\Users\Papa\AppData\Roaming\Adobe [2012.08.12 14:20:59 | 000,000,000 | ---D | C] -- C:\Users\Papa\AppData\Local\Microsoft Games [2012.08.12 14:03:15 | 000,000,000 | ---D | C] -- C:\Users\Papa\AppData\Roaming\Mozilla [2012.08.12 14:03:15 | 000,000,000 | ---D | C] -- C:\Users\Papa\AppData\Local\Mozilla [2012.08.12 14:01:11 | 000,000,000 | R--D | C] -- C:\Users\Papa\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup [2012.08.12 14:01:11 | 000,000,000 | R--D | C] -- C:\Users\Papa\Searches [2012.08.12 14:01:11 | 000,000,000 | R--D | C] -- C:\Users\Papa\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools [2012.08.12 14:01:02 | 000,000,000 | ---D | C] -- C:\Users\Papa\AppData\Roaming\Identities [2012.08.12 14:01:00 | 000,000,000 | R--D | C] -- C:\Users\Papa\Contacts [2012.08.12 13:09:04 | 000,040,776 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbamswissarmy.sys [2012.08.12 13:09:04 | 000,000,000 | ---D | C] -- C:\Users\Papa\AppData\Roaming\Malwarebytes [2012.08.12 13:08:44 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware [2012.08.12 13:08:42 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes [2012.08.12 13:08:41 | 000,022,344 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys [2012.08.12 12:07:08 | 000,255,488 | ---- | C] (XNN) -- C:\ProgramData\SoIaMjphesp9YP.exe [2012.08.12 11:53:19 | 000,348,672 | ---- | C] (XNN) -- C:\ProgramData\WQaJpUNUgPHe.exe [2012.07.22 22:50:49 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AmoK DVD Shrinker ========== Files - Modified Within 30 Days ========== [2012.08.12 21:33:36 | 000,596,992 | ---- | M] (OldTimer Tools) -- C:\Users\Papa\Desktop\OTL.exe [2012.08.12 21:18:55 | 000,015,331 | ---- | M] () -- C:\Windows\System32\Config.MPF [2012.08.12 21:11:24 | 000,618,192 | ---- | M] () -- C:\Windows\System32\perfh007.dat [2012.08.12 21:11:24 | 000,586,980 | ---- | M] () -- C:\Windows\System32\perfh009.dat [2012.08.12 21:11:24 | 000,122,636 | ---- | M] () -- C:\Windows\System32\perfc007.dat [2012.08.12 21:11:24 | 000,101,052 | ---- | M] () -- C:\Windows\System32\perfc009.dat [2012.08.12 21:07:44 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat [2012.08.12 21:02:11 | 000,003,216 | ---- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0 [2012.08.12 21:02:11 | 000,003,216 | ---- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0 [2012.08.12 13:09:36 | 000,040,776 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbamswissarmy.sys [2012.08.12 12:48:15 | 000,000,064 | ---- | M] () -- C:\ProgramData\-SoIaMjphesp9YP [2012.08.12 12:47:46 | 2146,676,736 | -HS- | M] () -- C:\hiberfil.sys [2012.08.12 12:14:14 | 000,000,064 | ---- | M] () -- C:\ProgramData\-SoIaMjphesp9YPr [2012.08.12 12:08:03 | 000,000,368 | ---- | M] () -- C:\ProgramData\SoIaMjphesp9YP [2012.08.12 12:07:08 | 000,255,488 | ---- | M] (XNN) -- C:\ProgramData\SoIaMjphesp9YP.exe [2012.08.12 12:05:46 | 000,000,000 | ---- | M] () -- C:\Windows\System32\LogConfigTemp.xml [2012.08.12 11:50:53 | 000,348,672 | ---- | M] (XNN) -- C:\ProgramData\WQaJpUNUgPHe.exe [2012.08.01 01:00:00 | 000,000,348 | ---- | M] () -- C:\Windows\tasks\McQcTask.job ========== Files Created - No Company Name ========== [2012.08.12 14:01:17 | 000,000,990 | ---- | C] () -- C:\Users\Papa\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk [2012.08.12 14:01:10 | 000,000,985 | ---- | C] () -- C:\Users\Papa\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows Media Player.lnk [2012.08.12 14:01:00 | 000,000,956 | ---- | C] () -- C:\Users\Papa\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows Mail.lnk [2012.08.12 12:14:14 | 000,000,064 | ---- | C] () -- C:\ProgramData\-SoIaMjphesp9YPr [2012.08.12 12:14:14 | 000,000,064 | ---- | C] () -- C:\ProgramData\-SoIaMjphesp9YP [2012.08.12 12:07:09 | 000,000,368 | ---- | C] () -- C:\ProgramData\SoIaMjphesp9YP [2012.06.16 00:03:07 | 000,000,043 | ---- | C] () -- C:\Windows\gswin32.ini [2012.06.15 09:49:03 | 000,000,044 | ---- | C] () -- C:\Windows\Acer(Normal).ini [2012.06.15 09:49:03 | 000,000,042 | ---- | C] () -- C:\Windows\Acer(Wide).ini [2012.06.14 15:04:47 | 000,097,392 | ---- | C] () -- C:\Windows\System32\drivers\Fwusb1b.bin [2012.06.14 12:52:12 | 000,000,403 | ---- | C] () -- C:\Windows\ODBC.INI [2012.06.14 12:34:35 | 000,000,032 | ---- | C] () -- C:\Windows\System32\drivers\rtkhdaud.dat [2012.06.14 12:31:29 | 000,004,984 | ---- | C] () -- C:\Windows\System32\drivers\nvphy.bin [2012.06.14 11:55:20 | 000,001,024 | R--- | C] () -- C:\Windows\System32\NTIOFM4.dll [2012.06.14 11:55:20 | 000,001,024 | R--- | C] () -- C:\Windows\System32\NTIBUN5.dll [2011.06.22 06:47:58 | 000,024,064 | ---- | C] () -- C:\Windows\System32\ssp7ml3.dll < End of report > OTL Extras logfile created on: 12.08.2012 21:37:09 - Run 1 OTL by OldTimer - Version 3.2.57.0 Folder = C:\Users\Papa\Desktop Windows Vista Home Premium Edition Service Pack 1 (Version = 6.0.6001) - Type = NTWorkstation Internet Explorer (Version = 7.0.6001.18000) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 2,00 Gb Total Physical Memory | 0,98 Gb Available Physical Memory | 49,21% Memory free 4,23 Gb Paging File | 2,60 Gb Available in Paging File | 61,55% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files Drive C: | 142,16 Gb Total Space | 6,74 Gb Free Space | 4,74% Space Free | Partition Type: NTFS Drive D: | 142,93 Gb Total Space | 41,89 Gb Free Space | 29,31% Space Free | Partition Type: NTFS Computer Name: FRANZI-PC | User Name: Papa | Logged in as Administrator. Boot Mode: Normal | Scan Mode: All users Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days ========== Extra Registry (SafeList) ========== ========== File Associations ========== [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>] .cpl [@ = cplfile] -- C:\Windows\System32\control.exe (Microsoft Corporation) .hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation) .url [@ = InternetShortcut] -- rundll32.exe ieframe.dll,OpenURL %l [HKEY_USERS\S-1-5-21-1740670893-1896631952-3822091605-1000\SOFTWARE\Classes\<extension>] .html [@ = FirefoxHTML] -- D:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation) ========== Shell Spawning ========== [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command] batfile [open] -- "%1" %* cmdfile [open] -- "%1" %* comfile [open] -- "%1" %* cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation) exefile [open] -- "%1" %* helpfile [open] -- Reg Error: Key error. hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation) inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation) InternetShortcut [open] -- rundll32.exe ieframe.dll,OpenURL %l piffile [open] -- "%1" %* regfile [merge] -- Reg Error: Key error. scrfile [config] -- "%1" scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l scrfile [open] -- "%1" /S txtfile [edit] -- Reg Error: Key error. Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1 Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation) Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation) Directory [OneNote.Open] -- C:\PROGRA~1\MICROS~2\Office12\ONENOTE.EXE "%L" (Microsoft Corporation) Folder [open] -- %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation) Folder [explore] -- %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation) Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation) ========== Security Center Settings ========== [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center] "cval" = 1 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiSpyware] "DisableMonitoring" = 1 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus] "DisableMonitoring" = 1 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall] "DisableMonitoring" = 1 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc] "AntiVirusOverride" = 0 "AntiSpywareOverride" = 0 "FirewallOverride" = 0 "VistaSp1" = Reg Error: Unknown registry data type -- File not found [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol] ========== Firewall Settings ========== [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile] "EnableFirewall" = 1 "DisableNotifications" = 0 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] "EnableFirewall" = 1 "DisableNotifications" = 0 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile] "EnableFirewall" = 1 "DisableNotifications" = 0 ========== Authorized Applications List ========== ========== Vista Active Open Ports Exception List ========== [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules] "{0348F966-6FBB-4EA9-A86C-534590131884}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 | "{1CDB347F-71FE-4C66-AE0E-AA3EE9D92CB8}" = rport=139 | protocol=6 | dir=out | app=system | "{452AAF47-88B6-4EBB-A9E3-DCDDD33165B7}" = lport=445 | protocol=6 | dir=in | app=system | "{8DDE18B7-80B3-4C04-BCAC-C965D0ACB451}" = rport=445 | protocol=6 | dir=out | app=system | "{A3DF0975-C8FE-4951-A02E-8F9B8C0C7E1A}" = lport=139 | protocol=6 | dir=in | app=system | "{C8795517-1B8C-42D2-9CD9-C46771835154}" = lport=138 | protocol=17 | dir=in | app=system | "{CAF960DD-CA95-4FAA-BB86-6338C0CD5EE6}" = rport=137 | protocol=17 | dir=out | app=system | "{D4347DE9-D0D8-46DF-8050-8F2147550B35}" = rport=138 | protocol=17 | dir=out | app=system | "{F5E79D79-AC11-405F-90AC-2714F1455305}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe | "{F99C9031-F656-47C4-BE62-6466A4A27EE0}" = lport=137 | protocol=17 | dir=in | app=system | ========== Vista Active Application Exception List ========== [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules] "{01FE3FD4-26C5-4E37-B930-B684975F193B}" = protocol=17 | dir=in | app=c:\program files\sweetim\communicator\sweetpacksupdatemanager.exe | "{07DA85B6-C018-4865-BCF9-166A71EC1B4A}" = protocol=6 | dir=in | app=c:\program files\newtech infosystems\nti backup now 5\schedulersvc.exe | "{10DEA36A-A6F0-4568-884F-645E251C3DE6}" = dir=in | app=c:\program files\acer arcade live\acer slideshow dvd\acer slideshow dvd.exe | "{1869C293-FB0D-4C67-BFD6-6ED4CFD93BE5}" = dir=in | app=c:\program files\common files\mcafee\mna\mcnasvc.exe | "{260AB72A-F760-407F-AEA3-5CDB93A31A23}" = protocol=17 | dir=in | app=c:\program files\newtech infosystems\nti backup now 5\backupsvc.exe | "{2E1B7D6D-2F48-427E-A7B7-40AA5E46348E}" = protocol=6 | dir=in | app=c:\program files\newtech infosystems\nti backup now 5\backupsvc.exe | "{3976701B-C292-45D3-9D48-1E81364F7947}" = dir=in | app=c:\program files\acer arcade live\acer homemedia connect\kernel\dms\clmsserver.exe | "{3C5E3CCE-5CB8-41AD-8E7B-2968D30F0AF0}" = protocol=17 | dir=in | app=c:\program files\newtech infosystems\nti backup now 5\client\agentsvc.exe | "{3C94599E-B44B-442C-8A9E-BFCB1CE2599E}" = protocol=6 | dir=in | app=c:\program files\sweetim\communicator\sweetpacksupdatemanager.exe | "{43651FB3-98FD-4678-8930-4EA7DE9AD1C9}" = dir=in | app=c:\program files\acer arcade live\acer homemedia connect\acer homemedia connect.exe | "{4A03E140-787F-4193-A083-1353B1BBC39A}" = protocol=6 | dir=in | app=c:\program files\newtech infosystems\nti backup now 5\client\agentsvc.exe | "{5558548C-2788-4D7B-9814-157A4F660312}" = dir=in | app=c:\program files\acer arcade live\acer dv magician\acer dv magician.exe | "{5DD397FA-170E-416A-81C9-F6B4693285E1}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 | "{6BB68B0D-D11A-48A4-BE1B-0B215B7030E1}" = dir=in | app=c:\program files\acer arcade live\acer videomagician\acer videomagician.exe | "{700E49C5-F76D-401D-BB4E-85F05E972951}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 | "{731057D2-B45B-4969-93B2-1155798CC3AB}" = dir=in | app=c:\program files\acer arcade live\acer arcade live main page\acer arcade live.exe | "{973CB9A0-AAA5-43FF-B19D-5298A5357A9F}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 | "{B06796BE-928E-48B1-B85E-46088151CB78}" = dir=in | app=c:\program files\acer arcade live\acer homemedia\acer homemedia.exe | "{B1373CDE-13BA-4AC4-A7EB-EF5D62B9A4B1}" = protocol=17 | dir=in | app=c:\windows\system32\msiexec.exe | "{B4542DCD-9F3D-4C4C-8238-4DAA193DE8E6}" = protocol=17 | dir=in | app=c:\program files\newtech infosystems\nti backup now 5\schedulersvc.exe | "{B4DD9959-42D2-4C03-80EE-31CC48E85113}" = protocol=6 | dir=in | app=c:\program files\microsoft office\office12\onenote.exe | "{C7F3C151-C0E4-464B-8D47-605A872912B7}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 | "{D03357EE-B605-4380-80EF-C2B3235848AB}" = protocol=17 | dir=in | app=c:\program files\microsoft office\office12\onenote.exe | "{D0A80936-D1F1-4E67-A265-3999A13F0CC9}" = dir=in | app=c:\program files\acer arcade live\acer homemedia trial creator\acer homemedia trial creator.exe | "{D3AB8735-8CE3-47AC-BD1E-B929CDFAD72A}" = dir=in | app=c:\program files\acer arcade live\acer dvdivine\acer dvdivine.exe | "{FC00E7F8-34AB-436C-A1CD-E64B1DF98475}" = protocol=6 | dir=in | app=c:\windows\system32\msiexec.exe | "TCP Query User{782BF6CE-562C-425D-BFC3-49324109EEF7}D:\program files\pap\panzers - phase1\run\panzers.exe" = protocol=6 | dir=in | app=d:\program files\pap\panzers - phase1\run\panzers.exe | "UDP Query User{30B02002-96CE-4C03-9760-29A3ECD5BA1D}D:\program files\pap\panzers - phase1\run\panzers.exe" = protocol=17 | dir=in | app=d:\program files\pap\panzers - phase1\run\panzers.exe | ========== HKEY_LOCAL_MACHINE Uninstall List ========== [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall] "{00010407-78E1-11D2-B60F-006097C998E7}" = Microsoft Office 2000 Professional "{0001B4FD-9EA3-4D90-A79E-FD14BA3AB01D}" = PDFCreator "{12EFA1A4-AC3B-443C-8143-237EDE760403}" = NTI Backup Now Standard "{132888AE-EF67-41C5-BCA2-7D5D2488AB63}" = Acer HomeMedia Connect "{13D85C14-2B85-419F-AC41-C7F21E68B25D}" = Acer eSettings Management "{15D967B5-A4BE-42AE-9E84-64CD062B25AA}" = eSobi v2 "{196467F1-C11F-4F76-858B-5812ADC83B94}" = MSXML 4.0 SP3 Parser "{2413930C-8309-47A6-BC61-5EF27A4222BC}" = NTI Media Maker 8 "{2FA06473-23F0-4372-8DD5-1EAE42503D93}" = MAGIX Video easy TERRATEC Edition "{39600969-41C3-4658-876E-16F108FC5C92}" = ISO Recorder "{41581EF5-45A7-11DA-9D78-000129760D75}" = Acer SlideShow DVD "{45CEBDDE-AD94-4C5A-999D-0D35CE61405B}_is1" = 1.5 "{4817189D-1785-4627-A33C-39FD90919300}" = Die Sims™ 2 Haustiere "{4EA2F95F-A537-4d17-9E7F-6B3FF8D9BBE3}" = Microsoft Works "{65DA2EC9-0642-47E9-AAE2-B5267AA14D75}" = Activation Assistant for the 2007 Microsoft Office suites "{6E7DD182-9FC6-4651-0095-2E666CC6AF35}" = Die Sims 2 "{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable "{7683B745-6060-41FD-AA75-0BBB383FEAD4}" = SweetIM for Messenger 3.7 "{774C0434-9948-4DEE-A14E-69CDD316E36C}" = Internet Explorer Toolbar 4.6 by SweetPacks "{79DD56FC-DB8B-47F5-9C80-78B62E05F9BC}" = Acer ScreenSaver "{7B3577F5-1D82-4C9B-008B-69D026FD8BCA}" = Die Sims 2: Open For Business "{7F811A54-5A09-4579-90E1-C93498E230D9}" = Acer eRecovery Management "{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-110111700}" = Zuma Deluxe "{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-11029123}" = Bricks of Egypt "{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-110322783}" = Big Kahuna Reef "{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-110411970}" = Chuzzle "{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-111118433}" = Mystery Case Files - Huntsville "{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-111199750}" = Cake Mania "{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-111252743}" = Mahjong Escape Ancient China "{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-111324990}" = Kick N Rush "{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-111543617}" = Backspin Billiards "{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-111692950}" = Mahjongg Artifacts "{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-111771833}" = Jewel Quest Solitaire "{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-111796363}" = Mystery Solitaire - Secret Island "{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-111872660}" = Diner Dash Flo on the Go "{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-112531267}" = Chicken Invaders 3 "{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-112615863}" = Agatha Christie Death on the Nile "{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-112920767}" = Alice Greenfingers "{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-113009953}" = Turbo Pizza "{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-113080210}" = Azada "{8F1B6239-FEA0-450A-A950-B05276CE177C}" = Acer Empowering Technology "{90120000-0016-0407-0000-0000000FF1CE}" = Microsoft Office Excel MUI (German) 2007 "{90120000-0016-0407-0000-0000000FF1CE}_HOMESTUDENTR_{DCBECE36-8F23-4B33-925E-A1C6183C0DBD}" = 2007 Microsoft Office Suite Service Pack 1 (SP1) "{90120000-0018-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (German) 2007 "{90120000-0018-0407-0000-0000000FF1CE}_HOMESTUDENTR_{DCBECE36-8F23-4B33-925E-A1C6183C0DBD}" = 2007 Microsoft Office Suite Service Pack 1 (SP1) "{90120000-001B-0407-0000-0000000FF1CE}" = Microsoft Office Word MUI (German) 2007 "{90120000-001B-0407-0000-0000000FF1CE}_HOMESTUDENTR_{DCBECE36-8F23-4B33-925E-A1C6183C0DBD}" = 2007 Microsoft Office Suite Service Pack 1 (SP1) "{90120000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2007 "{90120000-001F-0407-0000-0000000FF1CE}_HOMESTUDENTR_{2AB528A5-BB1B-4EBE-8E51-AD0C4CD33CA9}" = 2007 Microsoft Office Suite Service Pack 1 (SP1) "{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007 "{90120000-001F-0409-0000-0000000FF1CE}_HOMESTUDENTR_{3EC77D26-799B-4CD8-914F-C1565E796173}" = 2007 Microsoft Office Suite Service Pack 1 (SP1) "{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007 "{90120000-001F-040C-0000-0000000FF1CE}_HOMESTUDENTR_{430971B1-C31E-45DA-81E0-72C095BAB72C}" = 2007 Microsoft Office Suite Service Pack 1 (SP1) "{90120000-001F-0410-0000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2007 "{90120000-001F-0410-0000-0000000FF1CE}_HOMESTUDENTR_{58FC5E37-DD28-4D4A-A549-125744C6763C}" = 2007 Microsoft Office Suite Service Pack 1 (SP1) "{90120000-002C-0407-0000-0000000FF1CE}" = Microsoft Office Proofing (German) 2007 "{90120000-006E-0407-0000-0000000FF1CE}" = Microsoft Office Shared MUI (German) 2007 "{90120000-006E-0407-0000-0000000FF1CE}_HOMESTUDENTR_{888B9AC7-8F5C-456B-A27A-157A6C310E52}" = 2007 Microsoft Office Suite Service Pack 1 (SP1) "{90120000-00A1-0407-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (German) 2007 "{90120000-00A1-0407-0000-0000000FF1CE}_HOMESTUDENTR_{DCBECE36-8F23-4B33-925E-A1C6183C0DBD}" = 2007 Microsoft Office Suite Service Pack 1 (SP1) "{91120000-002F-0000-0000-0000000FF1CE}" = Microsoft Office Home and Student 2007 "{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{BEE75E01-DD3F-4D5F-B96C-609E6538D419}" = 2007 Microsoft Office Suite Service Pack 1 (SP1) "{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 "{A5633652-3795-4829-BB0B-644F0279E279}" = Acer eDataSecurity Management "{A8B0DBDE-8119-48B0-8088-D12DA01C36BA}" = DownloadnSave "{AA4BF92B-2AAF-11DA-9D78-000129760D75}" = Acer HomeMedia "{AC76BA86-7AD7-1031-7B44-A81000000003}" = Adobe Reader 8.1.0 - Deutsch "{B145EC69-66F5-11D8-9D75-000129760D75}" = Acer DVDivine "{B580C409-E16F-44FF-904D-3AE94E113BE0}" = Acer HomeMedia Trial Creator "{BC14F40D-7C13-4F3A-9F4A-3835D7642036}" = PE585QAEncoder-32 "{CE386A4E-D0DA-4208-8235-BCE43275C694}" = LightScribe 1.4.142.1 "{EFBDC2B0-FAA8-4B78-8DE1-AEBE7958FA37}" = Acer Arcade Live Main Page "{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver "{F6EFFB76-4A07-11DA-9D78-000129760D75}" = Acer DV Magician "{F79A208D-D929-11D9-9D77-000129760D75}" = Acer VideoMagician "{FB697452-8CA4-46B4-98B1-165C922A2EF3}" = Update Manager for SweetPacks 1.0 "Acer GameZone Console_is1" = Acer GameZone Console DTV 2.0.1.1 "Activation Assistant for the 2007 Microsoft Office suites" = Activation Assistant for the 2007 Microsoft Office suites "Adobe Flash Player ActiveX" = Adobe Flash Player ActiveX "Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin "AVMWLANCLI" = AVM FRITZ!WLAN "EPSON Scanner" = EPSON Scan "EPSON SX130 Series" = Druckerdeinstallation für EPSON SX130 Series "GPL Ghostscript 9.05" = GPL Ghostscript "HOMESTUDENTR" = Microsoft Office Home and Student 2007 "InstallShield_{12EFA1A4-AC3B-443C-8143-237EDE760403}" = NTI Backup Now 5 "InstallShield_{15D967B5-A4BE-42AE-9E84-64CD062B25AA}" = eSobi v2 "InstallShield_{2413930C-8309-47A6-BC61-5EF27A4222BC}" = NTI Media Maker 8 "MAGIX_MSI_Video_easy_3_TerraTec" = MAGIX Video easy TERRATEC Edition "Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware Version 1.62.0.1300 "Mozilla Firefox 13.0 (x86 de)" = Mozilla Firefox 13.0 (x86 de) "MozillaMaintenanceService" = Mozilla Maintenance Service "MSC" = McAfee SecurityCenter "NVIDIA Drivers" = NVIDIA Drivers "ShockwaveFlash" = Adobe Flash Player 9 ActiveX ========== HKEY_USERS Uninstall List ========== [HKEY_USERS\S-1-5-21-1740670893-1896631952-3822091605-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall] "Mozilla Firefox 14.0.1 (x86 de)" = Mozilla Firefox 14.0.1 (x86 de) ========== Last 20 Event Log Errors ========== [ Application Events ] Error - 03.08.2012 08:04:56 | Computer Name = Franzi-PC | Source = WinMgmt | ID = 10 Description = Error - 03.08.2012 13:44:45 | Computer Name = Franzi-PC | Source = WinMgmt | ID = 10 Description = Error - 04.08.2012 00:26:06 | Computer Name = Franzi-PC | Source = WinMgmt | ID = 10 Description = Error - 04.08.2012 03:58:38 | Computer Name = Franzi-PC | Source = WinMgmt | ID = 10 Description = Error - 04.08.2012 07:17:32 | Computer Name = Franzi-PC | Source = WinMgmt | ID = 10 Description = Error - 04.08.2012 15:11:51 | Computer Name = Franzi-PC | Source = WinMgmt | ID = 10 Description = Error - 05.08.2012 08:00:15 | Computer Name = Franzi-PC | Source = McLogEvent | ID = 5051 Description = Ein Thread in Vorgang C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe brauchte länger als 90000 ms, um eine Anfrage auszuführen. Der Vorgang wird beendet. Thread-ID: 3000 (0xbb8) Thread-Adresse: 0x120DBCCE Thread-Nachricht: Build VSCORE.14.0.0.349 / 5200.2160 Object being scanned = \Device\HarddiskVolume2\Program Files\McAfee\MSC\mclgview.exe by c:\PROGRA~1\mcafee\msc\mcupdmgr.exe 4(0)(0) 4(0)(0) 7200(0)(0) 7595(0)(0) 7005(0)(0) 7004(0)(0) 5006(0)(0) 5004(0)(0) Error - 06.08.2012 13:12:46 | Computer Name = Franzi-PC | Source = WinMgmt | ID = 10 Description = Error - 07.08.2012 15:07:48 | Computer Name = Franzi-PC | Source = WinMgmt | ID = 10 Description = Error - 07.08.2012 16:54:32 | Computer Name = Franzi-PC | Source = WinMgmt | ID = 10 Description = [ System Events ] Error - 19.07.2012 03:23:27 | Computer Name = Franzi-PC | Source = HTTP | ID = 15016 Description = Error - 19.07.2012 03:24:48 | Computer Name = Franzi-PC | Source = Service Control Manager | ID = 7000 Description = Error - 20.07.2012 04:13:40 | Computer Name = Franzi-PC | Source = HTTP | ID = 15016 Description = Error - 20.07.2012 04:15:02 | Computer Name = Franzi-PC | Source = Service Control Manager | ID = 7000 Description = Error - 21.07.2012 03:18:14 | Computer Name = Franzi-PC | Source = HTTP | ID = 15016 Description = Error - 21.07.2012 03:19:49 | Computer Name = Franzi-PC | Source = Service Control Manager | ID = 7000 Description = Error - 21.07.2012 08:44:47 | Computer Name = Franzi-PC | Source = HTTP | ID = 15016 Description = Error - 21.07.2012 08:46:21 | Computer Name = Franzi-PC | Source = Service Control Manager | ID = 7000 Description = Error - 22.07.2012 11:16:06 | Computer Name = Franzi-PC | Source = HTTP | ID = 15016 Description = Error - 22.07.2012 11:17:39 | Computer Name = Franzi-PC | Source = Service Control Manager | ID = 7000 Description = < End of report > So! Und nun? Danke, wer auch immer hier Hilfe gibt. Papa |
|
16.08.2012, 13:18
| #2 | |
| /// Winkelfunktion /// TB-Süch-Tiger™   | File recovery in der Taskleiste + System error messageZitat:
NICHTS voreilig aus der Quarantäne löschen!
__________________ |
|
17.08.2012, 07:22
| #3 |
| |  File recovery in der Taskleiste + System error message Moin.
__________________In die Quarantäne habe ich alle Funde schon verschoben. Da alle bisherigen Meldungen auf diesen Umstand, dass nichts zu entfernen ist ( Ihr steht auf die Dinger...) besonders abgehoben haben, tat ich da auch nix. Und nun....?  ein Papa |
|
17.08.2012, 19:58
| #4 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | File recovery in der Taskleiste + System error message Bitte erstmal routinemäßig einen neuen Vollscan mit Malwarebytes machen und Log posten. =>ALLE lokalen Datenträger (außer CD/DVD) überprüfen lassen! Denk daran, dass Malwarebytes vor jedem Scan manuell aktualisiert werden muss! Die Funde mit Malwarebytes bitte alle entfernen, sodass sie in der Quarantäne von Malwarebytes aufgehoben werden! NICHTS voreilig aus der Quarantäne entfernen! Falls Logs aus älteren Scans mit Malwarebytes vorhanden sind, bitte auch davon alle posten! ESET Online Scanner
Bitte alles nach Möglichkeit hier in CODE-Tags posten. Wird so gemacht: [code] hier steht das Log [/code] Und das ganze sieht dann so aus: Code:
ATTFilter hier steht das Log
__________________ Logfiles bitte immer in CODE-Tags posten  |
|
18.08.2012, 12:53
| #5 |
| | File recovery in der Taskleiste + System error message 1. Danke für die Info. 2. Da ich ja bereits Log- Files gepostet habe, wäre es für die "Neuen" wie mich gut auch zu hören, ob dies so bisher auch i.O. war! Da bin ich mir nun mit meiner ersten Antwort - Mail mit Logs eben nicht sicher.... kompletter Malwarescan: ################################################### Malwarebytes Anti-Malware (Trial) 1.62.0.1300 www.malwarebytes.org Database version: v2012.08.18.02 Windows Vista Service Pack 1 x86 NTFS Internet Explorer 7.0.6001.18000 Netzbenutzer :: FRANZI-PC [limited] Protection: Disabled 18.08.2012 12:24:24 mbam-log-2012-08-18 (12-24-24).txt Scan type: Full scan (C:\|D:\|) Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM Scan options disabled: P2P Objects scanned: 309804 Time elapsed: 57 minute(s), 14 second(s) Memory Processes Detected: 2 C:\ProgramData\WQaJpUNUgPHe.exe (Rogue.FakeHDD) -> 3520 -> Delete on reboot. C:\ProgramData\SoIaMjphesp9YP.exe (Rogue.FakeHDD) -> 2704 -> Delete on reboot. Memory Modules Detected: 1 C:\ProgramData\DownloadnSave\bhoclass.dll (PUP.DownloadnSave) -> Delete on reboot. Registry Keys Detected: 6 HKCR\CLSID\{96DE4F15-8EF3-5425-4360-D37D8DA9371D} (PUP.DownloadnSave) -> Delete on reboot. HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{96DE4F15-8EF3-5425-4360-D37D8DA9371D} (PUP.DownloadnSave) -> Delete on reboot. HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{96DE4F15-8EF3-5425-4360-D37D8DA9371D} (PUP.DownloadnSave) -> Quarantined and deleted successfully. HKCR\TypeLib\{C2CF0D01-7657-48AA-98C9-AE5E64757FCC} (PUP.DownloadnSave) -> Delete on reboot. HKCR\Interface\{BBA74401-6D6F-4BBD-9F65-E8623814F3BB} (PUP.DownloadnSave) -> Delete on reboot. HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{A8B0DBDE-8119-48B0-8088-D12DA01C36BA} (PUP.DownloadnSave) -> Delete on reboot. Registry Values Detected: 3 HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|WQaJpUNUgPHe.exe (Rogue.FakeHDD) -> Data: C:\ProgramData\WQaJpUNUgPHe.exe -> Quarantined and deleted successfully. HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|SoIaMjphesp9YP (Rogue.FakeHDD) -> Data: C:\ProgramData\SoIaMjphesp9YP.exe -> Quarantined and deleted successfully. HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|LicenseValidator (Trojan.Proxy) -> Data: C:\Users\Netzbenutzer\AppData\Roaming\Identities\{ECEB30EE-3DC7-4CB2-88FC-B205C8974BFC}\LicenseValidator.exe -> Quarantined and deleted successfully. Registry Data Items Detected: 2 HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced|Start_ShowMyComputer (PUM.Hijack.StartMenu) -> Bad: (0) Good: (1) -> Quarantined and repaired successfully. HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced|Start_ShowSearch (PUM.Hijack.StartMenu) -> Bad: (0) Good: (1) -> Quarantined and repaired successfully. Folders Detected: 2 C:\ProgramData\DownloadnSave (PUP.DownloadnSave) -> Delete on reboot. C:\ProgramData\DownloadnSave\data (PUP.DownloadnSave) -> Delete on reboot. Files Detected: 18 C:\ProgramData\WQaJpUNUgPHe.exe (Rogue.FakeHDD) -> Delete on reboot. C:\ProgramData\SoIaMjphesp9YP.exe (Rogue.FakeHDD) -> Delete on reboot. C:\ProgramData\DownloadnSave\bhoclass.dll (PUP.DownloadnSave) -> Delete on reboot. C:\Users\Netzbenutzer\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\J4GCR3XH\Gxv1zF45[1].exe (Exploit.Drop.COD) -> Quarantined and deleted successfully. C:\Users\Netzbenutzer\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\J4GCR3XH\krevkqcmdubtfvdz8[1].exe (Rogue.FakeHDD) -> Quarantined and deleted successfully. C:\Users\Netzbenutzer\AppData\Local\Temp\tmpA8E6.tmp.exe (RootKit.0Access) -> Quarantined and deleted successfully. C:\Users\Netzbenutzer\AppData\Local\Temp\wYHCrAaxE5MMYA.exe.tmp (Rogue.FakeHDD) -> Quarantined and deleted successfully. C:\Users\Netzbenutzer\Desktop\Downloads\MB-Scrsaver.zip.exe (Affiliate.Downloader) -> Quarantined and deleted successfully. C:\Users\Papa\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\W6JK739V\4fdbb519d63b4[1].exe (Adware.Dropper) -> Delete on reboot. C:\Users\Papa\AppData\Local\Temp\{FFFE3346-117B-503B-B2D0-5959241D11B0}\Addons\download_save.exe (Adware.Dropper) -> Delete on reboot. C:\Users\Netzbenutzer\AppData\Local\Temp\wuauclt.exe (Trojan.Agent) -> Quarantined and deleted successfully. C:\ProgramData\DownloadnSave\content.js (PUP.DownloadnSave) -> Delete on reboot. C:\ProgramData\DownloadnSave\background.html (PUP.DownloadnSave) -> Delete on reboot. C:\ProgramData\DownloadnSave\odeoclokhmjimjdcfohekbelankbmihb.crx (PUP.DownloadnSave) -> Delete on reboot. C:\ProgramData\DownloadnSave\settings.ini (PUP.DownloadnSave) -> Delete on reboot. C:\ProgramData\DownloadnSave\uninstall.exe (PUP.DownloadnSave) -> Delete on reboot. C:\ProgramData\DownloadnSave\data\content.js (PUP.DownloadnSave) -> Delete on reboot. C:\ProgramData\DownloadnSave\data\jsondb.js (PUP.DownloadnSave) -> Delete on reboot. (end) ##################################################### ICh habe dann remove als einzige wählbare Option vorgenommen- die Ergebnisse sind in der Quarantäne dann sichtbar gewesen: ################################################### Malwarebytes Anti-Malware (Trial) 1.62.0.1300 www.malwarebytes.org Database version: v2012.08.18.02 Windows Vista Service Pack 1 x86 NTFS Internet Explorer 7.0.6001.18000 Netzbenutzer :: FRANZI-PC [limited] Protection: Disabled 18.08.2012 12:24:24 mbam-log-2012-08-18 (13-31-52).txt Scan type: Full scan (C:\|D:\|) Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM Scan options disabled: P2P Objects scanned: 309804 Time elapsed: 57 minute(s), 14 second(s) Memory Processes Detected: 2 C:\ProgramData\WQaJpUNUgPHe.exe (Rogue.FakeHDD) -> 3520 -> No action taken. C:\ProgramData\SoIaMjphesp9YP.exe (Rogue.FakeHDD) -> 2704 -> No action taken. Memory Modules Detected: 1 C:\ProgramData\DownloadnSave\bhoclass.dll (PUP.DownloadnSave) -> No action taken. Registry Keys Detected: 6 HKCR\CLSID\{96DE4F15-8EF3-5425-4360-D37D8DA9371D} (PUP.DownloadnSave) -> No action taken. HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{96DE4F15-8EF3-5425-4360-D37D8DA9371D} (PUP.DownloadnSave) -> No action taken. HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{96DE4F15-8EF3-5425-4360-D37D8DA9371D} (PUP.DownloadnSave) -> No action taken. HKCR\TypeLib\{C2CF0D01-7657-48AA-98C9-AE5E64757FCC} (PUP.DownloadnSave) -> No action taken. HKCR\Interface\{BBA74401-6D6F-4BBD-9F65-E8623814F3BB} (PUP.DownloadnSave) -> No action taken. HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{A8B0DBDE-8119-48B0-8088-D12DA01C36BA} (PUP.DownloadnSave) -> No action taken. Registry Values Detected: 3 HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|WQaJpUNUgPHe.exe (Rogue.FakeHDD) -> Data: C:\ProgramData\WQaJpUNUgPHe.exe -> No action taken. HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|SoIaMjphesp9YP (Rogue.FakeHDD) -> Data: C:\ProgramData\SoIaMjphesp9YP.exe -> No action taken. HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|LicenseValidator (Trojan.Proxy) -> Data: C:\Users\Netzbenutzer\AppData\Roaming\Identities\{ECEB30EE-3DC7-4CB2-88FC-B205C8974BFC}\LicenseValidator.exe -> No action taken. Registry Data Items Detected: 2 HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced|Start_ShowMyComputer (PUM.Hijack.StartMenu) -> Bad: (0) Good: (1) -> No action taken. HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced|Start_ShowSearch (PUM.Hijack.StartMenu) -> Bad: (0) Good: (1) -> No action taken. Folders Detected: 2 C:\ProgramData\DownloadnSave (PUP.DownloadnSave) -> No action taken. C:\ProgramData\DownloadnSave\data (PUP.DownloadnSave) -> No action taken. Files Detected: 18 C:\ProgramData\WQaJpUNUgPHe.exe (Rogue.FakeHDD) -> No action taken. C:\ProgramData\SoIaMjphesp9YP.exe (Rogue.FakeHDD) -> No action taken. C:\ProgramData\DownloadnSave\bhoclass.dll (PUP.DownloadnSave) -> No action taken. C:\Users\Netzbenutzer\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\J4GCR3XH\Gxv1zF45[1].exe (Exploit.Drop.COD) -> No action taken. C:\Users\Netzbenutzer\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\J4GCR3XH\krevkqcmdubtfvdz8[1].exe (Rogue.FakeHDD) -> No action taken. C:\Users\Netzbenutzer\AppData\Local\Temp\tmpA8E6.tmp.exe (RootKit.0Access) -> No action taken. C:\Users\Netzbenutzer\AppData\Local\Temp\wYHCrAaxE5MMYA.exe.tmp (Rogue.FakeHDD) -> No action taken. C:\Users\Netzbenutzer\Desktop\Downloads\MB-Scrsaver.zip.exe (Affiliate.Downloader) -> No action taken. C:\Users\Papa\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\W6JK739V\4fdbb519d63b4[1].exe (Adware.Dropper) -> No action taken. C:\Users\Papa\AppData\Local\Temp\{FFFE3346-117B-503B-B2D0-5959241D11B0}\Addons\download_save.exe (Adware.Dropper) -> No action taken. C:\Users\Netzbenutzer\AppData\Local\Temp\wuauclt.exe (Trojan.Agent) -> No action taken. C:\ProgramData\DownloadnSave\content.js (PUP.DownloadnSave) -> No action taken. C:\ProgramData\DownloadnSave\background.html (PUP.DownloadnSave) -> No action taken. C:\ProgramData\DownloadnSave\odeoclokhmjimjdcfohekbelankbmihb.crx (PUP.DownloadnSave) -> No action taken. C:\ProgramData\DownloadnSave\settings.ini (PUP.DownloadnSave) -> No action taken. C:\ProgramData\DownloadnSave\uninstall.exe (PUP.DownloadnSave) -> No action taken. C:\ProgramData\DownloadnSave\data\content.js (PUP.DownloadnSave) -> No action taken. C:\ProgramData\DownloadnSave\data\jsondb.js (PUP.DownloadnSave) -> No action taken. (end) ###################################################### SO! Und nun? Kann ich das ESET - LOg so hier weitergeben, wie ich es bisher mitdem Maleware - Log getan habe? Ich benutze regulär Firefox. Der ist aber nun nicht nutzbar...... Also bin ich mit dem IE hier. Welche ESET-Version nehme ich nun? Und wenn ich das ESET laufen lasse, und alle störenden Programme abschalten soll: Ist dies ein Internet- basierendes Suchprogramm? Muss ich online sein? Oder aber offline - was mein erster Gedanke wäre ( Ich lade etwas runter - das Etwas kommt von euch - ist also vertrauenswürdig, dann gehe ich offline - habe ein Ergebnis) das ich dann wieder zurücksende - online. Mag blöd klingen, aber wie nun? Welches ESET? Das es ein ONLINE - Programm ist habe ich nun auch gesehen......... Da ich mit dem IE Unterwegs bin - nutze ich nun das vorgeschlagenen....? Sind die Logs in der gewünschten Form - ich kann da nix sehen....? DAnke bis bald? Ich bleibe hier dran....  |
|
18.08.2012, 14:21
| #6 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | File recovery in der Taskleiste + System error message Sry irgendwie spinnt das Laden der grafik, die da eigentlich in der ESET-Anleitung sein sollte Im als Administrator geöffneten Browser diesen Link aufrufen => http://www.eset.com/online-scanner-popup Und bitte die Logs alle in CODE-Tags posten!!!
__________________ --> File recovery in der Taskleiste + System error message |
|
18.08.2012, 14:38
| #7 |
| | File recovery in der Taskleiste + System error message Mahlzeit. ESET ist gelaufen. Das Log konnte ich nicht auf die beschriebene Weise erzeugen. Aber da ja die Anwendung ein TXT file erzeugen kann..... ESET - Log: C:\Program Files\Acer Arcade Live\Acer HomeMedia Trial Creator\Export\SoftDMA_Trial\Autorun.inf INF/Autorun.gen worm C:\ProgramData\SoIaMjphesp9YP.exe a variant of Win32/Kryptik.AKAD trojan C:\ProgramData\WQaJpUNUgPHe.exe a variant of Win32/Kryptik.AKAD trojan C:\ProgramData\DownloadnSave\bhoclass.dll Win32/Adware.MultiPlug.A application C:\ProgramData\DownloadnSave\uninstall.exe Win32/Adware.MultiPlug.A application C:\Users\All Users\SoIaMjphesp9YP.exe a variant of Win32/Kryptik.AKAD trojan C:\Users\All Users\WQaJpUNUgPHe.exe a variant of Win32/Kryptik.AKAD trojan C:\Users\All Users\DownloadnSave\bhoclass.dll Win32/Adware.MultiPlug.A application C:\Users\All Users\DownloadnSave\uninstall.exe Win32/Adware.MultiPlug.A application C:\Users\Papa\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\W6JK739V\4fdbb519d63b4[1].exe Win32/Adware.MultiPlug.A application C:\Users\Papa\AppData\Local\Temp\{FFFE3346-117B-503B-B2D0-5959241D11B0}\Addons\download_save.exe Win32/Adware.MultiPlug.A application Operating memory multiple threats Und jetzt?  Papa |
|
18.08.2012, 14:41
| #8 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | File recovery in der Taskleiste + System error message adwCleaner - Toolbars und ungewollte Start-/Suchseiten aufspüren Downloade Dir bitte AdwCleaner auf deinen Desktop.
__________________ Logfiles bitte immer in CODE-Tags posten |
|
18.08.2012, 19:12
| #9 |
| | File recovery in der Taskleiste + System error message Boah ey! Nur 3 Minuten bis zur Antwort. Ich bitte um Entschuldigung - wir haben gegrillt.... "Blödes Gelabere - wo ist das File....?" Ich habe den Artikel "Tags" "gelesen" - aber nicht verstanden... Ihr wollte keine Txt - Dateien - ja was wollt ihr denn? Also wie? Mit etwas Apostroph etc ist es ja wohl nicht getan?! Also nochmal ein TXT.... Mit der Bitte um Nachsicht.... File: # AdwCleaner v1.801 - Logfile created 08/18/2012 at 20:10:30 # Updated 14/08/2012 by Xplode # Operating system : Windows Vista (TM) Home Premium Service Pack 1 (32 bits) # User : Papa - FRANZI-PC # Boot Mode : Normal # Running from : C:\Users\Netzbenutzer\Desktop\adwcleaner.exe # Option [Search] ***** [Services] ***** ***** [Files / Folders] ***** Folder Found : C:\Users\Netzbenutzer\AppData\LocalLow\DownloadnSave Folder Found : C:\Users\Netzbenutzer\AppData\LocalLow\SweetIM Folder Found : C:\Users\Franzi\AppData\LocalLow\SweetIM Folder Found : C:\Users\Papa\AppData\LocalLow\SweetIM Folder Found : C:\Users\Netzbenutzer\AppData\Roaming\pdfforge Folder Found : C:\Users\Papa\AppData\Roaming\pdfforge Folder Found : C:\ProgramData\DownloadnSave Folder Found : C:\ProgramData\InstallMate Folder Found : C:\ProgramData\SweetIM Folder Found : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DownloadnSave Folder Found : C:\Program Files\SweetIM Folder Found : C:\Windows\Installer\{FB697452-8CA4-46B4-98B1-165C922A2EF3} Folder Found : C:\ProgramData\Partner Folder Found : C:\ProgramData\Premium File Found : C:\Users\Netzbenutzer\AppData\Roaming\Mozilla\Firefox\Profiles\7m3yuwzk.default\searchplugins\SweetIm.xml File Found : C:\Users\Netzbenutzer\AppData\Roaming\Mozilla\Firefox\Profiles\7m3yuwzk.default\extensions\{EEE6C361-6118-11DC-9C72-001320C79847}.xpi ***** [Registry] ***** Key Found : HKLM\SOFTWARE\Classes\bhoclass.bho.bhoclass.bho Key Found : HKLM\SOFTWARE\Classes\bhoclass.bho.bhoclass.bho.1.0 Key Found : HKLM\SOFTWARE\Classes\MediaPlayer.GraphicsUtils Key Found : HKLM\SOFTWARE\Classes\MediaPlayer.GraphicsUtils.1 Key Found : HKLM\SOFTWARE\Classes\MgMediaPlayer.GifAnimator Key Found : HKLM\SOFTWARE\Classes\MgMediaPlayer.GifAnimator.1 Key Found : HKLM\SOFTWARE\Classes\sim-packages Key Found : HKLM\SOFTWARE\Classes\SWEETIE.IEToolbar Key Found : HKLM\SOFTWARE\Classes\SWEETIE.IEToolbar.1 Key Found : HKLM\SOFTWARE\Classes\sweetim_urlsearchhook.toolbarurlsearchhook Key Found : HKLM\SOFTWARE\Classes\sweetim_urlsearchhook.toolbarurlsearchhook.1 Key Found : HKLM\SOFTWARE\Classes\Toolbar3.sweetie Key Found : HKLM\SOFTWARE\Classes\Toolbar3.sweetie.1 Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\SweetIM.exe Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{A8B0DBDE-8119-48B0-8088-D12DA01C36BA} Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{FB697452-8CA4-46B4-98B1-165C922A2EF3} Key Found : HKLM\SOFTWARE\SweetIM Value Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run [SweetIM] Value Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run [Sweetpacks Communicator] ***** [Registre - GUID] ***** Key Found : HKLM\SOFTWARE\Classes\CLSID\{82AC53B4-164C-4B07-A016-437A8388B81A} Key Found : HKLM\SOFTWARE\Classes\CLSID\{A4A0CB15-8465-4F58-A7E5-73084EA2A064} Key Found : HKLM\SOFTWARE\Classes\CLSID\{EEE6C35B-6118-11DC-9C72-001320C79847} Key Found : HKLM\SOFTWARE\Classes\CLSID\{EEE6C35C-6118-11DC-9C72-001320C79847} Key Found : HKLM\SOFTWARE\Classes\CLSID\{EEE6C35D-6118-11DC-9C72-001320C79847} Key Found : HKLM\SOFTWARE\Classes\Interface\{A439801C-961D-452C-AB42-7848E9CBD289} Key Found : HKLM\SOFTWARE\Classes\Interface\{BBA74401-6D6F-4BBD-9F65-E8623814F3BB} Key Found : HKLM\SOFTWARE\Classes\Interface\{D2F39980-399F-492E-8D88-5FF7CCB3B47F} Key Found : HKLM\SOFTWARE\Classes\Interface\{EEE6C358-6118-11DC-9C72-001320C79847} Key Found : HKLM\SOFTWARE\Classes\Interface\{EEE6C359-6118-11DC-9C72-001320C79847} Key Found : HKLM\SOFTWARE\Classes\Interface\{EEE6C35A-6118-11DC-9C72-001320C79847} Key Found : HKLM\SOFTWARE\Classes\Interface\{F4EBB1E2-21F3-4786-8CF4-16EC5925867F} Key Found : HKLM\SOFTWARE\Classes\TypeLib\{4D3B167E-5FD8-4276-8FD7-9DF19C1E4D19} Key Found : HKLM\SOFTWARE\Classes\TypeLib\{C2CF0D01-7657-48AA-98C9-AE5E64757FCC} Key Found : HKLM\SOFTWARE\Classes\TypeLib\{EEE6C35E-6118-11DC-9C72-001320C79847} Key Found : HKLM\SOFTWARE\Classes\TypeLib\{EEE6C35F-6118-11DC-9C72-001320C79847} Key Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{EEE6C367-6118-11DC-9C72-001320C79847} Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{EEE6C35C-6118-11DC-9C72-001320C79847} Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{EEE6C35B-6118-11DC-9C72-001320C79847} Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{EEE6C35C-6118-11DC-9C72-001320C79847} Value Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{EEE6C35B-6118-11DC-9C72-001320C79847}] Value Found : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{EEE6C35B-6118-11DC-9C72-001320C79847}] Value Found : HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks [{EEE6C35D-6118-11DC-9C72-001320C79847}] ***** [Internet Browsers] ***** -\\ Internet Explorer v7.0.6001.18000 [OK] Registry is clean. -\\ Mozilla Firefox v13.0 (de) Profile name : default File : C:\Users\Netzbenutzer\AppData\Roaming\Mozilla\Firefox\Profiles\7m3yuwzk.default\prefs.js [OK] File is clean. Profile name : default File : C:\Users\Franzi\AppData\Roaming\Mozilla\Firefox\Profiles\z5entuql.default\prefs.js [OK] File is clean. Profile name : default File : C:\Users\Papa\AppData\Roaming\Mozilla\Firefox\Profiles\hjxx7x27.default\prefs.js [OK] File is clean. ************************* AdwCleaner[R1].txt - [5481 octets] - [18/08/2012 20:10:30] ########## EOF - \AdwCleaner[R1].txt - [5609 octets] ########## Und....? Guten Morgen... Nein Firefox lässt sich nach wie vor ( natürlich) nicht öffnen, der IE scheint mir sehr langsam zu sein, Mails - bei Yahoo - lassen sich nicht abrufen... Mal so als Zwischenstand....  Morgen! Beim Update malware erhalte ich eine Fehlermeldung PROGRAMM_ERROR_UPDATING (5, 0, MBAMFileIOWriteFile) Zugriff verweigert NA und dann ist er fertig.... 3. Versuch heute Sonntag eine Merldung hereinzubringen... Was von gestern abend ab "Guten Morgen" steht, ist auch von heute.... Der IE nudelt sich einen ab und braucht immer länger zum Seitenaufbau.... Windowsdefender meldete sich mit 2 mal der Meldungen "Trojan:Win32/FakeSysdef" Dies habe ich mal in die Quaantäne verschoben - erfolgreich als Status.... Wie gesagt, Malware lässt sich nicht aktualisieren..... Grüsse und besoanders heute immer schön kühl bleiben.... Papa Geändert von cfmmk (18.08.2012 um 19:22 Uhr) |
|
20.08.2012, 16:33
| #10 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | File recovery in der Taskleiste + System error message Es steht doch nun wirklich haarklein erklärt wie das mit den CODE-Tags geht! Dafür hat man auch extra bei der über das Beitragstextfenster verschiedene Formatierbuttons, der Button mit # beschriftet oist für die CODE-Tags! Nochmal: Bitte alles nach Möglichkeit hier in CODE-Tags posten. Wird so gemacht: [code] hier steht das Log [/code] Und das ganze sieht dann so aus: Code:
ATTFilter hier steht das Log
__________________ Logfiles bitte immer in CODE-Tags posten |
|
21.08.2012, 18:54
| #11 |
| | File recovery in der Taskleiste + System error message Hallo und Danke für die Info. Jetzt weiss ich also, dass die Logs bisher also nicht lesbar waren - nicht verwertbar? Aber ich habe die Frage schon beim ersten Mal gestellt. Und jetzt? Habe ich was erreicht? Ich weiss das "Cosinus" in den Urlaub geht. Sei gegönnt. Und was weiter? Soll ich das eine oder das andere Log neu einstellen?  Danke.... |
|
22.08.2012, 20:26
| #12 |
| | File recovery in der Taskleiste + System error message Hallo Cosinus macht Urlaub. Und was mach ich jetzt?  Danke sehr.... |
|
30.08.2012, 13:08
| #13 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | File recovery in der Taskleiste + System error message Wäre schön, wenn du dir mal etwas mehr Mühe geben könntest! Es kann doch nicht zuviel verlangt sein, den die Log in vernünftiger Formatierung zu posten! Bei der Formatierleistee gibt es extra den Button der mit # beschriftet ist für die CODE-Boxen! adwCleaner - Toolbars und ungewollte Start-/Suchseiten entfernen
__________________ Logfiles bitte immer in CODE-Tags posten |
|
08.09.2012, 12:49
| #14 |
| | File recovery in der Taskleiste + System error message Guten Tag und bitte - die Datei: Und jetzt also ? ein  ( zur "Sicherheit" auch als Anhang): # AdwCleaner v1.801 - Logfile created 09/08/2012 at 13:36:01 # Updated 14/08/2012 by Xplode # Operating system : Windows Vista (TM) Home Premium Service Pack 1 (32 bits) # User : Papa - FRANZI-PC # Boot Mode : Normal # Running from : C:\Users\Netzbenutzer\Desktop\adwcleaner.exe # Option [Delete] ***** [Services] ***** ***** [Files / Folders] ***** Folder Deleted : C:\Users\Netzbenutzer\AppData\LocalLow\DownloadnSave Folder Deleted : C:\Users\Netzbenutzer\AppData\LocalLow\SweetIM Folder Deleted : C:\Users\Franzi\AppData\LocalLow\SweetIM Folder Deleted : C:\Users\Netzbenutzer\AppData\Roaming\pdfforge Folder Deleted : C:\Users\Papa\AppData\Roaming\pdfforge Folder Deleted : C:\ProgramData\DownloadnSave Folder Deleted : C:\ProgramData\InstallMate Folder Deleted : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DownloadnSave Folder Deleted : C:\Program Files\SweetIM Folder Deleted : C:\ProgramData\Partner Folder Deleted : C:\ProgramData\Premium File Deleted : C:\Users\Netzbenutzer\AppData\Roaming\Mozilla\Firefox\Profiles\7m3yuwzk.default\searchplugins\SweetIm.xml File Deleted : C:\Users\Netzbenutzer\AppData\Roaming\Mozilla\Firefox\Profiles\7m3yuwzk.default\extensions\{EEE6C361-6118-11DC-9C72-001320C79847}.xpi ***** [Registry] ***** Key Deleted : HKLM\SOFTWARE\Classes\bhoclass.bho.bhoclass.bho Key Deleted : HKLM\SOFTWARE\Classes\bhoclass.bho.bhoclass.bho.1.0 Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{A8B0DBDE-8119-48B0-8088-D12DA01C36BA} Key Deleted : HKLM\SOFTWARE\SweetIM ***** [Registre - GUID] ***** Key Deleted : HKLM\SOFTWARE\Classes\Interface\{BBA74401-6D6F-4BBD-9F65-E8623814F3BB} Key Deleted : HKLM\SOFTWARE\Classes\Interface\{D2F39980-399F-492E-8D88-5FF7CCB3B47F} Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{C2CF0D01-7657-48AA-98C9-AE5E64757FCC} Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{EEE6C35B-6118-11DC-9C72-001320C79847} Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{EEE6C35C-6118-11DC-9C72-001320C79847} Value Deleted : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{EEE6C35B-6118-11DC-9C72-001320C79847}] Value Deleted : HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks [{EEE6C35D-6118-11DC-9C72-001320C79847}] ***** [Internet Browsers] ***** -\\ Internet Explorer v7.0.6001.18000 [OK] Registry is clean. -\\ Mozilla Firefox v13.0 (de) Profile name : default File : C:\Users\Netzbenutzer\AppData\Roaming\Mozilla\Firefox\Profiles\7m3yuwzk.default\prefs.js [OK] File is clean. Profile name : default File : C:\Users\Franzi\AppData\Roaming\Mozilla\Firefox\Profiles\z5entuql.default\prefs.js [OK] File is clean. Profile name : default File : C:\Users\Papa\AppData\Roaming\Mozilla\Firefox\Profiles\hjxx7x27.default\prefs.js [OK] File is clean. ************************* AdwCleaner[R4].txt - [3167 octets] - [21/08/2012 20:39:33] AdwCleaner[R5].txt - [3227 octets] - [08/09/2012 13:35:43] AdwCleaner[S1].txt - [3028 octets] - [08/09/2012 13:36:01] AdwCleaner[R1].txt - [5608 octets] - [18/08/2012 20:10:30] AdwCleaner[R2].txt - [5668 octets] - [19/08/2012 01:06:47] AdwCleaner[R3].txt - [5728 octets] - [19/08/2012 11:27:56] ########## EOF - \AdwCleaner[S1].txt - [3336 octets] ########## |
|
10.09.2012, 15:00
| #15 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | File recovery in der Taskleiste + System error message Immer noch keine CODE-Tags!
__________________ Logfiles bitte immer in CODE-Tags posten |
|
| Themen zu File recovery in der Taskleiste + System error message |
| affiliate.downloader, browser, diner dash, error, excel, file recovery, firefox, flash player, frage, helper, home, iexplore.exe, install.exe, logfile, malware, msiexec.exe, phishing, popup, realtek, registry, scan, siteadvisor, software, stick, sweetim, system, system error, usb, vista, wuauclt.exe |
Linear-Darstellung
